{"uuid": "4d9a32dc-ee0a-4226-bac1-e5f7481e2525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102829", "type": "seen", "source": "https://gist.github.com/alon710/a68f146c2be91af7aba5098416de5c67", "content": "# CVE-2026-102829: CVE-2026-102829: Security Control Bypass and Command Injection via VISUAL Environment Variable in @simple-git/argv-parser\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102829\n\n## Summary\nA critical security control bypass vulnerability exists in @simple-git/argv-parser before version 2.0.1. The package fails to map the VISUAL environment variable to the allowUnsafeEditor rule, allowing attackers who control environment parameters to execute arbitrary commands when Git triggers an interactive editor fallback.\n\n## TL;DR\nOmission of the VISUAL environment variable from the GitEnvKeys lookup registry allows an attacker-controlled VISUAL variable to bypass simple-git security checks, leading to arbitrary command execution when Git falls back to an interactive editor.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78 / CWE-184\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00275 (Percentile: 18.07%)\n- **Impact**: Unauthenticated Remote Code Execution\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications using simple-git with untrusted environment variables\n- Applications using @simple-git/argv-parser < 2.0.1\n- **@simple-git/argv-parser**: < 2.0.1 (Fixed in: `2.0.1`)\n- **simple-git**: < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade @simple-git/argv-parser to version 2.0.1 or higher.\n- Sanitize and strip environment parameters (VISUAL, EDITOR, GIT_EDITOR) before passing them to simple-git.\n- Enforce a static high-priority editor configuration like GIT_EDITOR=true.\n\n**Remediation Steps:**\n1. Identify all applications utilizing simple-git or @simple-git/argv-parser.\n2. Execute 'npm update @simple-git/argv-parser' or 'npm install simple-git@latest'.\n3. Verify that the dependency tree resolves @simple-git/argv-parser to version 2.0.1 or above.\n4. Optionally implement input sanitization to strip user-controlled environment keys.\n\n## References\n\n- [CVE-2026-102829 Record](https://www.cve.org/CVERecord?id=CVE-2026-102829)\n- [NVD - CVE-2026-102829](https://nvd.nist.gov/vuln/detail/CVE-2026-102829)\n- [GitHub Security Advisory GHSA-v5rq-49vh-5v5c](https://github.com/steveukx/git-js/security/advisories/GHSA-v5rq-49vh-5v5c)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102829) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T04:30:32.000000Z"}